PDF malware analysis — malicious · d93dd0702f6903a2

MALICIOUS

PDF

34.3 KB Created: 2021-07-06 06:03:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-05

MD5: e766b9e96dd3650b8a323217ec5a1d6f SHA-1: 380fc16bc6d9128f04a7c7a55fb08072c8aa981a SHA-256: d93dd0702f6903a233d71abb701e270224187fc767a7efd9d523e2cf467ec159

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a lure related to game hacks, specifically for Roblox and Coin Master. The primary heuristic indicates a 'game hack redirector' lure, suggesting the document's purpose is to trick users into visiting malicious sites. While no scripts were explicitly extracted, the nature of the lures and embedded URLs strongly suggests a phishing or scam attempt, likely leading to further malware downloads or credential harvesting.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/431946152/how-to-get-free-roebucks-on-roblox-game-hack PDF link annotation
- https://privatearrangements.co.nz/public/files/robux-free-robux-generator_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/minecraft-xray-hack_GM479516143.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/free-dominus-userscripts-roblox_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/toolbox-for-mcpe_GM479516143.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/hacking-coolrichytimemax-in-roblox-youtube_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/coin-master-heaven-daily-free-spins-and-coins-links_GM406889139.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/descargar-coin-master-hackeado_GM406889139.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/can-you-be-hacked-by-an-id-on-roblox_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/www-roblox-hack-robux_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/how-to-get-free-money-on-roblox-adopt-me_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/rich-free-roblox-accounts_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/daily-free-spins-coin-master-app_GM406889139.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/free-pet-food-on-coin-master_GM406889139.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/free-pet-food-for-coin-master_GM406889139.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/reach-hacks-roblox_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/free-robux-no-verification-needed_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/coin-master-el-tiger-card-free_GM406889139.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/how-to-get-free-robux-legit-computer_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/free-robux-wheel_GM431946152.pdfIn PDF document text
- https://privatearrangements.co.nz/public/files/game-toolbox_GM479516143.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003042.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3042	21844 bytes
SHA-256: `0fcec405a05c54c0b72cb5e0c31839ff38b9618dd02f24e7039a88169f2659e5`
`font_01_sfnt_off00006064.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6064	19228 bytes
SHA-256: `e0defeb3cdfa0b2bd15f1d655f37073a2afc05a1f059c7295c9a06f93db64536`

Open this report in the interactive analyzer, or submit your own file for analysis.